Challenging FTC Regulation Of Cyber-Security After FTC v. Wyndham

The Third Circuit interlocutory decision in Federal Trade Commission v. Wyndham Worldwide Corporation was widely reported as a big win for the Federal Trade Commission ("FTC"). But on closer examination, it was a split decision in which Wyndham Worldwide Corporation ("Wyndham") can claim an important victory. While affirming the FTC's authority to regulate cyber-security practices under the "unfair practices" prong of the Federal Trade Commission Act (the "FTC Act"), the Third Circuit also rejected the FTC's contention that FTC settlements and consent orders in cyber-security cases with unrelated parties have created standards against which Wyndham's practices can be tested for "unfairness." This Third Circuit decision identifies defenses companies should develop when facing FTC allegations that the company's cyber-security practices are "unfair."¹